CVE-2026-33390: Privilege Escalation in Nozomi Networks CMC & Guardian Sync

Technical summary

CVE-2026-33390 is an Incorrect Privilege Assignment vulnerability (CWE-266) affecting the synchronization functionality in Nozomi Networks CMC and Guardian products. The Arc sensors are granted CLI permissions that should be restricted, enabling authenticated users with low privileges to execute high-impact administrative commands via the sync channel. The CVSS v3.1 score of 8.1 (HIGH) reflects high impact on integrity and availability, low attack complexity, and network-based attack vector, though the vulnerability requires prior authentication.

Business impact

This vulnerability allows authenticated insiders or compromised low-privilege accounts to modify critical device configurations without authorization, potentially causing operational disruption, network misalignment, or loss of monitoring visibility in industrial and critical infrastructure environments where Nozomi Guardian is deployed. The ability to alter device configuration through synchronization could undermine network security posture and compliance controls.

Affected systems

Nozomi Networks CMC and Guardian products are affected. Organizations running these platforms should identify which versions are deployed and determine the authentication scope (which users or systems can trigger synchronization). Verify affected product versions against Nozomi Networks' official advisory to confirm exposure.

Exploitability

Exploitability requires valid authentication credentials and access to the synchronization functionality. An attacker cannot exploit this remotely as an anonymous user; however, any authenticated user—including those intentionally granted minimal privileges—can leverage the flaw to escalate their actions to administrative scope. The low attack complexity and network accessibility make this practical to exploit once authentication is achieved.

Remediation

Apply security updates from Nozomi Networks for CMC and Guardian products. Verify the patched version numbers against the vendor's advisory. As an interim mitigation, restrict synchronization access to trusted administrative personnel and implement network segmentation to limit who can authenticate to these systems. Review role-based access control (RBAC) configurations to ensure low-privilege accounts do not retain unexpected synchronization rights.

Patch guidance

Contact Nozomi Networks or consult their security advisory for the specific patched version numbers for CMC and Guardian. Apply patches to all affected instances in your environment. Test patches in a non-production setting before deployment to ensure compatibility with your operational setup. After patching, verify that low-privilege user roles no longer retain CLI-level synchronization capabilities.

Detection guidance

Monitor synchronization logs for administrative CLI commands being executed by low-privilege authenticated users. Audit user role assignments and verify that synchronization permissions align with intended access levels. Check for unexpected configuration changes initiated through the sync channel. Alert on any authentication attempts or command execution from low-privilege accounts that access Arc sensors or trigger sync operations. Review Arc sensor permission grants in the device configuration management interface.

Why prioritize this

This vulnerability merits prompt attention due to its HIGH CVSS score (8.1), high impact on both integrity and availability, and the critical nature of devices typically running Nozomi Guardian in industrial and infrastructure environments. Although it requires authentication, the ability for low-privilege users to execute administrative commands poses a significant risk to operational continuity and asset integrity. The lack of known public exploitation (KEV status: false) provides a window to patch before active attack development.

Risk score, explained

The CVSS 3.1 score of 8.1 reflects: network-based attack vector (AV:N) allowing remote exploitation, low attack complexity (AC:L) with no special conditions required, requirement for low-level authentication (PR:L) reducing but not eliminating risk, no user interaction needed (UI:N), and high impact to both integrity (I:H) and availability (A:H) of affected systems. Confidentiality is not impacted. The score appropriately weights the privilege escalation severity balanced against the authentication barrier.

Frequently asked questions